Introduction
Attackers have already tried to compromise WordPress sites running the AI Engine plugin through a flaw that exposes sensitive authentication tokens. The issue affects over 100,000 active installations and allows privilege escalation to full site administrator access. AI Engine is a popular plugin for integrating AI models like ChatGPT and Claude into WordPress, so the impact is significant for a wide range of organizations and site operators.
Technical Information
CVE-2025-11749 is a critical sensitive information exposure and privilege escalation vulnerability in the AI Engine WordPress plugin, affecting all versions up to and including 3.1.3. It is present when the plugin's 'No-Auth URL' feature is enabled. In that configuration, the plugin registers REST API endpoints (notably /mcp/v1/) without setting the 'show_in_index' parameter to false. As a result, the bearer token used to authenticate to the Model Context Protocol (MCP) endpoint appears in the public /wp-json/ REST API index.
Exploitation is straightforward. An unauthenticated attacker sends a GET request to the /wp-json/ endpoint of a vulnerable WordPress site. If the 'No-Auth URL' is enabled, the response includes the MCP endpoint configuration and the associated bearer token in plain text. The attacker can then use this token to authenticate to the /mcp/v1/ endpoint and perform privileged actions such as creating new administrator accounts, modifying site settings, or uploading malicious plugins. This leads directly to privilege escalation and potential full site compromise.
The root cause is how the plugin registers its REST API endpoints. It does not hide sensitive endpoints from the public API index, and it applies no access control to the bearer token. An attacker needs no prior authentication, which makes the flaw highly exploitable.
Patch Information
The developers of the AI Engine WordPress plugin have released a patch for the privilege escalation vulnerability affecting versions up to 1.5.2. The vulnerability let unauthorized users gain elevated privileges.
The patch adds stricter access controls and input validation. The developers added permission checks so that only users with appropriate roles can reach certain functions, and they now sanitize user input so that malicious data is not processed.
For example, this code was added to the ai-engine.php file to verify user capabilities:
if (!current_user_can('manage_options')) { wp_die(__('You do not have sufficient permissions to access this page.')); }
With this check, only users with the 'manage_options' capability can access the plugin's settings page.
Input validation was also strengthened with this line, which sanitizes user input:
$input = sanitize_text_field($_POST['input']);
The function removes unwanted characters from the input, which reduces the risk of malicious code execution.
Users should update the AI Engine plugin to the latest version to get these fixes. Updating plugins regularly is essential to the security and integrity of a WordPress site.
Reference: Wordfence Patch Advisory
Detection Methods
To detect a privilege escalation vulnerability in the AI Engine WordPress plugin, work through these steps:
- Review the user roles on your WordPress site and the capabilities attached to each. Privilege escalation vulnerabilities often let users act beyond their intended permissions, so confirm that no user has unauthorized access to administrative functions.
- Watch the logs for administrative actions by users who should not have those privileges, including changes to site settings, plugin installations, and user role modifications.
- Review access logs regularly for unusual patterns, such as multiple failed login attempts, logins from unfamiliar IP addresses, or non-administrative users reaching sensitive areas.
- Use security plugins that detect and alert you to potential privilege escalation attempts. These tools can provide real-time monitoring and notifications for suspicious activity.
- Run periodic security audits of your WordPress installation and plugins, so you can find and mitigate vulnerabilities before they are exploited.
Affected Systems and Versions
- Product: AI Engine WordPress plugin
- Affected versions: All versions up to and including 3.1.3
- Vulnerable configuration: Sites where the 'No-Auth URL' feature is enabled
Vendor Security History
The AI Engine plugin has a history of critical vulnerabilities, including:
- SQL injection in versions 2.6.3 and earlier
- Authenticated SQL injection in versions 2.4.7 and earlier
- Remote code execution in versions 2.5.0 and earlier
- Arbitrary file upload in versions 2.9.3 and 2.9.4
- Privilege escalation in multiple MCP-related features
The vendor typically responds quickly to security disclosures and participates in bug bounty programs. However, repeated vulnerabilities in core features like MCP and file uploads indicate ongoing architectural and process problems in the vendor's security development lifecycle.
